Information security demands a layered approach in IP SANs.

As the need for information storage and backup continues to rise exponentially, many companies have migrated away from Fibre Channel SANs and NAS and begun investigating and implementing cost-effective IP SANs. IP SANs are storage networks connected over IP networks with information packets being sent within a SCSI command between an iSCSI initiator and iSCSI target. The average company has an IP-based infrastructure already in place and established IT guidelines, making the implementation of an IP SAN easy and affordable.

However, specifically because IP SANs may use the Internet (hailed as the world's quintessential open medium for information and idea exchange) some companies hesitate. Send confidential company information via the Internet? Is it secure? How do I know that the right people will get the right information? How do I identify the "right" people?

These are legitimate questions that some insight into the available Internet, iSCSI and SAN technologies can answer.

An IP SAN includes four layers:

* LAN perimeter

* Inter-LAN communications

* Initiator authorization

* Initiator authentication 

IP SAN security is not left to any single layer, as an iSCSI command makes its way through each of the four layers. How to protect them is the question.

IP SAN Overview

An IP SAN has three main types of components: storage devices, hosts and switches. The storage devices and hosts sit at opposite ends of the SAN and are connected in the middle through the IP network switches. iSCSI initiators in the host connect through the IP switch to iSCSI targets in the storage devices to access information.

IP SAN-enabling products (software, hardware or a combination) deliver virtualization of physical storage into customized, sizable virtual volumes. Virtualization can increase security in an IP SAN by enabling unique partitioning of physical storage and applying rules for access to each partition. Intelligent IP SAN switches sit in the data path between the storage devices and the IP network switch.

The LAN Perimeter

The first layer of protection in an IP SAN is the wall separating the internal network or Local Area Network (LAN) from the outside networks. This wall is the gateway through which information enters and leaves the LAN. Controlling this perimeter controls information access and flow.

A firewall usually sits on the perimeter between the internal and external networks. A firewall provides traffic control between these two networks and can be closed to stop all traffic flow or selectively opened at specific locations to allow specific IP traffic through.

The iSCSI initiator login attempt trying to pass through the firewall must be on the firewall's list of IPs allowed to cross the firewall. If it is, it also must enter through the correct port and be of the correct protocol. All firewalls should also have some method for authentication.

The switch supports alternate iSCSI communication port configurations. A port other than the standard iSCSI port can be used for iSCSI communications, making unauthorized login attempts harder.

Inter-LAN Communications

If a LAN is closed to outside networks, information will be more secure. However, most companies need to be connected to outside networks. Isolation isn't an option.

When information crosses through the private/public border, it can lose the security it enjoyed in a LAN. One cannot build a wall around information as it travels between networks; however, it is possible to create secure tunnels and safeguard the information during its journey.

A Virtual Private Network (VPN) creates a secure transport tunnel for data in motion between two LANs using high-level encryption. A VPN appliance is placed at the public/private border of each LAN. Encryption keys and groups are then configured for point-to-point encryption decoding to guard against eavesdropping.

When the iSCSI initiator login attempt passes through the firewall and travels to another LAN, it is encrypted by the VPN as it leaves its LAN and is decoded by the VPN at the entrance to the second LAN. Intelligent IP SAN switches support VPN tunneling appliances and methods, allowing information flowing through the switch to be encrypted during 'public' travel between LANs.

The iSCSI initiator login attempt that made it successfully through the firewall arrives securely to the switch's LAN.

iSCSI Initiator Authorization

So far, security measures have taken place in two layers of your IP SAN. An iSCSI initiator login attempt has qualified for access at each network layer. It is now at the specific iSCSI target device. Does the device allow anyone who can find it to log in? At this point, each device is on its own.

Certain devices support the creation of an Access Control List (ACL) for a target to establish which iSCSI initiators are allowed or denied access to it. Besides determining which iSCSI initiators can access the device, the type of access can also be set: read-write or read-only.

At the switch layer, ACL configurations are supported on a per-target per-initiator basis. The switch ACL uses the iSCSI initiator's WWUI (world wide unique identifier) to identify it. More than one initiator can be allowed access to a target and each initiator's access rights can be independently configured. Access to a target can also be denied to an iSCSI initiator.

iSCSI Initiator Authentication

An iSCSI initiator login attempt seems to come from an ACL-approved source. But how do we know that the iSCSI initiator realy is who it says it is? How do we know it isn't an impostor? What if our club--the iSCSI target--has a secret handshake that all members need to know to gain admittance? Something more elaborate and foolproof than "I know Dave."

Challenge-Handshake Authentication Protocol (CHAP) is an authentication protocol that can be used to authenticate iSCSI initiators at target login. The iSCSI target server sends an encrypted user name and password challenge to the initiator. The initiator must answer the challenge. Without the correct answer, the iSCSI session login attempt is terminated.

The IP SAN switch ACL supports CHAP and SRP authentication for its iSCSI targets. The user name and password are configured and stored on the switch. As an additional safety measure, the switch includes a RADIUS client for supporting a RADIUS server. Instead of storing the user name and password together on the switch, the user password can be stored on the RADIUS server.

IP SANs answer the growing need for more cost-effective and secure SAN implementations. Using readily available IP security technologies, data transfer over the IP network is secure without increasing the cost of ownership of an IP SAN. IP SAN switches add initiator authorization and authentication to your existing security measures.

IP Security encryption technologies are due to be incorporated into next-generation intelligent switches to provide for full data encryption within the LAN. Additionally, look to future switches including technologies to protect your data against even theft of the physical storage disks.

Zophar Sante is vice president, market development, at SAN-RAD, Inc. (Silicon Valley, CA)

www.sanrad.com